Client Advisory · Microsoft Entra ID
7 August 2026
7 August 2026
Passkeys become the default. SMS and voice sign-in retire.
Microsoft is notifying every Microsoft Entra ID tenant of a change to authentication security. Passkeys are becoming the default authentication experience, and Microsoft-provided SMS and voice authentication will retire on 1 February 2027. Anyone still signing in with a code sent by text message or phone call needs to move to a stronger method before then.
TLDR
Every SMS and voice user must be on a phishing-resistant method — passkeys are recommended — before 1 February 2027. Acting before 1 September 2026 lets us move users on your schedule and avoid blocking sign-in prompts.
Key Dates
1 Sep 2026
Users enabled for SMS or voice are automatically enabled for passkeys, and are nudged to register one at their next MFA prompt.
18 Sep 2026
Third-party telecom provider options and pricing are published in the Microsoft Security Store.
30 Oct 2026
Customer-managed telecom providers can be configured, for tenants with a regulatory need to keep SMS or voice.
1 Feb 2027
Microsoft-provided SMS and voice are fully retired in Microsoft Entra ID. Customer-managed providers are unaffected.
After 1 Feb 2027
Anyone whose only MFA method is SMS or voice hits a blocking prompt to register a passkey before they can sign in. There is no opt out — it applies to all tenants.
What This Means For You
No SMS or voice users. No action required — the change passes you by.
Some SMS or voice users. Every one moves to a passkey before 1 February 2027. We handle the tenant configuration and the registration campaign.
A regulatory need to keep SMS. We configure a customer-managed telecom provider through the Microsoft Security Store instead.
SMS and voice are among the most vulnerable methods available today — markedly weaker against phishing, SIM-swap, and replay attacks than passkeys.
What Happens Next
01
Audit. We identify who in your tenant is still enabled for SMS or voice.
02
Migrate. We enable passkeys and run a registration campaign ahead of 1 September 2026.
03
Communicate. We give you the wording for your people — what changes, when, and what they do.
04
Exception handling. Where a telecom provider is genuinely required, we configure one before 1 February 2027.